Enable the trimRushEnvironmentVariablesForOperations experiment.

common/config/rush/experiments.json

@@ -116,7 +116,7 @@
    * subspace.  This is useful for large product groups who work in separate subspaces and generally prefer to consume
    * each other's packages via the NPM registry.
    */
-  // "exemptDecoupledDependenciesBetweenSubspaces": true,
+  "exemptDecoupledDependenciesBetweenSubspaces": true,
 
   /**
    * If true, when running on macOS, Rush will omit AppleDouble files (._*) from build cache archives
@@ -140,5 +140,29 @@
    * must implement the optional file-based methods for this to take effect; otherwise it falls back to the
    * buffer-based approach.
    */
-  "useDirectFileTransfersForBuildCache": true
+  "useDirectFileTransfersForBuildCache": true,
+
+  /**
+   * By default, Rush forwards its entire process environment (minus a small denylist) to the shell
+   * commands it invokes for operations (e.g. 'build', 'test'). If true, environment variables whose
+   * names begin with `RUSH_` will additionally be omitted from that forwarded environment. This can
+   * help prevent operation scripts from accidentally depending on Rush's own internal environment
+   * variables.
+   */
+  "trimRushEnvironmentVariablesForOperations": true
+
+  /**
+   * PNPM 10.34.2 through 10.x and PNPM 11.5.3 through versions earlier than 11.6.0 ignore "${VAR}"
+   * tokens that appear in credentials and registry URLs in a project or workspace .npmrc file. If
+   * true for those versions, Rush expands the tokens itself: credentials are passed using
+   * "npm_config_*" environment variables instead of being written to the generated .npmrc file, and
+   * non-secret settings such as registry URLs are written with their values already expanded. PNPM
+   * 11.6.0 and newer support URL-scoped "pnpm_config_//..." environment variables, which should
+   * instead be supplied directly by CI so the trusted environment binds each credential to its
+   * registry. For example, supply an environment variable named
+   * "pnpm_config_//registry.npmjs.org/:_authToken" whose value is the registry token. Dynamic
+   * registry and proxy settings must likewise be supplied through trusted user, global, CLI, or
+   * environment configuration rather than a project .npmrc.
+   */
+  // "provideNpmrcCredentialsViaEnvironment": true
 }